evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: Fix out-of-bounds read in string class name.

Browse source 
jpeg driver is calling class_create with stack variable, which
can be overwritten by other stack variables.

Bug: 114041685
Change-Id: I3c22a5b3375b970ff6b1c6de983dd5833f4e11d0
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
This commit is contained in:
Trishansh Bhardwaj 2018-07-06 16:08:12 +05:30 • committed by Daniel Hillenbrand
parent d02272f418
commit 20beccf7d4
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_dev.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. /* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -32,6 +32,8 @@
#define MSM_JPEG_NAME "jpeg" #define MSM_JPEG_NAME "jpeg"
#define DEV_NAME_LEN 10 #define DEV_NAME_LEN 10
static char devname[DEV_NAME_LEN];
static int msm_jpeg_open(struct inode *inode, struct file *filp) static int msm_jpeg_open(struct inode *inode, struct file *filp)
{ {
int rc = 0; int rc = 0;
@ -185,7 +187,6 @@ static int msm_jpeg_init_dev(struct platform_device *pdev)
struct msm_jpeg_device *msm_jpeg_device_p; struct msm_jpeg_device *msm_jpeg_device_p;
const struct of_device_id *device_id; const struct of_device_id *device_id;
const struct msm_jpeg_priv_data *priv_data; const struct msm_jpeg_priv_data *priv_data;
char devname[DEV_NAME_LEN];
msm_jpeg_device_p = kzalloc(sizeof(struct msm_jpeg_device), GFP_ATOMIC); msm_jpeg_device_p = kzalloc(sizeof(struct msm_jpeg_device), GFP_ATOMIC);
if (!msm_jpeg_device_p) { if (!msm_jpeg_device_p) {
@ -328,6 +329,7 @@ static struct platform_driver msm_jpeg_driver = {
static int __init msm_jpeg_driver_init(void) static int __init msm_jpeg_driver_init(void)
{ {
int rc; int rc;
rc = platform_driver_register(&msm_jpeg_driver); rc = platform_driver_register(&msm_jpeg_driver);
return rc; return rc;
} }